Part one of three: a clear look at AI, security and governance for Australian businesses.
For years, Essential Eight maturity has been the shorthand for “are we secure?” in Australian business. But that shorthand now has an expected end date. For businesses considering AI adoption, it’s important to understand that the Essential Eight was never designed with AI in mind.
In June 2026, the Australian Signals Directorate opened consultation on what it calls the evolution of the Essential Eight: a new series called the ASD Essentials, built on the Information Security Manual. The current guidance became the first chapter, covering enterprise IT, when the series launched in October 2026 alongside chapters for operational technology and cloud. Speaking to iTnews, ASD’s head of cyber security resilience, Chris Horlyck, indicated both frameworks would run side by side for around twelve months, with deprecation beginning then and full retirement expected within about two years.
The reasoning is sensible. The Essential Eight was written before cloud was the default, and its prescriptive, technology-specific controls don’t translate cleanly to a world of shared responsibility and SaaS. ASD had also signalled that agentic AI could become a chapter of its own, pointing to the identity and access problems that come with non-human entities, and to prompt injection, an attack category that didn’t exist when the original eight were drafted. When the series launched, ASD covered AI through a supporting publication, AI considerations within the Essentials, that applies across all three chapters.
If you’ve been told that Essential Eight maturity is the measure of whether you’re ready for AI, this change is worth understanding. The investment hasn’t been wasted, but the way you evidence it is about to change. And AI readiness is often measured against a framework that was never built to answer that question.
The Essential Eight was never an AI control set
It’s a good list: patching, admin privileges, multi-factor authentication, application control, macros, backups. Every one of those still matters.
But read it again with an AI rollout in mind, and notice what isn’t on it:
- Nothing about who can see which files
- Nothing about whether your commercially sensitive documents are labelled
- Nothing about what happens when a tool can instantly read and summarise everything a staff member has access to
- Nothing about AI agents holding standing access to your data: who authorised them, what they can reach, or who switches them off when the person who built them leaves
These are the areas where AI rollouts tend to run into trouble.
When the Australian Public Service trialled Microsoft 365 Copilot in 2024, the problems reported weren’t patching failures. Staff found the tool surfacing information they shouldn’t have been able to see, because permissions and information management hadn’t kept pace with what the tool could reach. As one agency representative put it: “This is a governance and data management issue – not a Copilot issue.”
Every Essential Eight control could have been at maturity level three, and that would still have happened.
“Our security’s solid, so we’re covered”: a reassurance worth testing
At some point in an AI conversation, someone will tell you your existing security posture already handles this. It’s usually well-intentioned, and it tends to arrive in one of a few forms:
- We’re at Essential Eight maturity level two, so we’re in good shape
- We’ve completed the security questionnaire and nothing flagged
- We hold the certification, so the controls are covered
- The tool maps to most of the framework, so it’s fine
None of that is dishonest. It’s just answering a different question.
A framework tells you which defensive controls you’ve implemented. It doesn’t tell you what your data looks like, or who can see it. Those are separate questions, and AI only cares about the second one. You can be well defended against intruders and still have years of accumulated internal access that hasn’t been reviewed. That internal access is what determines what an AI tool can surface.
Put another way: a locked front door tells you nothing about who already has keys to which rooms.
The useful counter-question isn’t about frameworks at all. It’s: can you show me what our AI tools can currently reach, and who else can see the same things? If the answer comes back as a maturity level or a certificate, you’ve asked a data question and been given a compliance answer. It’s worth asking the question again, more specifically.
There’s a timing dimension too. If your AI readiness case rests on a mapping to the Essential Eight, that case now has a shelf life of about two years, and the reason is related: the framework was built for a different environment.
The work that reduces risk is the work that travels
Here’s the encouraging part, and why we’re not telling anyone to stop what they’re doing. ASD has said existing Essential Eight investment stays relevant, and the new series shifts away from prescriptive controls toward outcomes and intent. The work that reduces your risk is also the work that survives a change of framework.
A maturity score doesn’t travel. Evidence does.
Five things you should be able to evidence
Two of them are things that should be true about your environment. Three are things you should be able to demonstrate that you do.
What should be true about your environment
- A permissions position you can describe. Which sites and libraries hold sensitive material, who can reach them, and where sharing was set to “anyone with the link” three years ago for a good reason and never revisited. This is unglamorous, and it’s the highest-value item on the list.
- Labels applied where it matters. Not a taxonomy document, but labels on real files, so protection stays with the content instead of depending on where it happens to sit. Start with the handful of places where a leak would hurt: board papers, contracts, HR, client financials.
What you should be able to demonstrate
- An AI register with named owners. What AI tools and agents are in use, what data each one touches, and who is accountable for it. Include the things people forget, such as the agents someone in operations has quietly built, meeting transcription tools and browser extensions. ASD now asks for something very similar (more on that below), which reinforces the value of keeping a register.
- A short acceptable use policy. Two or three pages in plain language, covering what shouldn’t go into AI tools, who checks the output before it’s relied on, and how long you keep AI interactions.
- A quarterly review. Access reviews, a look at what’s been added to the register, and a check that the register still reflects what’s happening in the business.
This isn’t intended to be another checklist to score yourself against. The aim is to have clear evidence of your security practices that remains useful as frameworks change. You can then provide it to an insurer, an enterprise customer, an auditor or a regulator, whether you’re working with the Essential Eight today or the new Essentials framework in future.
Where the AI controls are landing
Since June 2026, ASD’s Information Security Manual, the foundation the new ASD Essentials series is built on, has carried controls written specifically for AI.
September’s update went considerably further, including requirements for:
- A unique identity for every AI agent
- A register recording each agent’s owner, business purpose, credentials, and the tools, permissions and data it can reach
- Least-privilege limits on what agents can do
- Central logging of agent activity
- Treating anything an agent reads from outside as untrusted
It also strengthened an earlier control so sensitive or high-impact actions now require human approval before execution, rather than merely being flagged.
These controls sit outside the Essential Eight, which is a fixed set of eight mitigation strategies covering areas such as patching, macros and backups.
The agent identity and register controls sit within the ISM’s guidelines for system access, alongside authentication and privileged access. ASD is treating AI agents as an identity and access management issue, which is worth considering when building your own register.
It’s also important to be clear about scope: the ISM is written for government systems and binds a private business only where a contract or framework makes it so. But Australian buyers increasingly ask against it, and it provides a useful indication of where security expectations are heading.
For broader governance, the National AI Centre’s Guidance for AI Adoption sets out six essential practices:
- Decide who is accountable
- Understand impacts and plan accordingly
- Measure and manage risks
- Share essential information
- Test and monitor
- Maintain human control
It’s the updated and simplified successor to the Voluntary AI Safety Standard and its ten guardrails. That’s worth knowing, because a lot of published material still cites the guardrails as current.
Where Copilot fits
We recommend Microsoft 365 Copilot as the default starting point for most customers, for a straightforward reason: if your business already runs on Microsoft 365, it works within an environment you’ve already established.
Prompts and responses aren’t used to train the underlying models, access controls are honoured so Copilot surfaces only what that user could already reach, and with the appropriate auditing configuration, interactions can be logged, including which files were referenced and what their sensitivity labels were.
Compare that with someone pasting a client contract into a free chatbot on their phone: your organisation may have no log, no visibility over how that data is handled, and no way of knowing it happened.
One caveat we’d rather you heard from us: Copilot’s reach is exactly your permissions. That isn’t a flaw to be trained away. It’s the architecture, and it’s why the work above isn’t optional preparation. It is the control.
How RES can help
We work with organisations that want to adopt AI while making sure the right security and governance measures are in place:
- A factual picture of where your sensitive data lives and who can reach it, before any tool is switched on or scaled up
- Remediation planned so people can keep working while security risks are addressed
- The five items above, sized for your business rather than for a 30,000-person enterprise
- Evidence you can provide to an insurer, a customer or an auditor without a scramble
The aim isn’t simply to map your security against a framework. It’s to understand whether your data is ready for AI.
What to do next
Don’t stop your Essential Eight work. It’s still a recognised framework in critical infrastructure rules, government policy and plenty of contracts today, and the underlying controls are sound.
But don’t let it stand in for AI governance. That needs its own evidence, and the AI controls are arriving in the ISM, as covered above.
The six governance practices and five practical areas outlined here give Australian mid-market businesses a starting point for strengthening AI governance, while still making progress with adoption.
Want to know where you stand? Book a short discovery session with RES and we’ll give you a straight answer on what’s ready, what isn’t, and what to do first.
Next in this series: what to do if you’ve already switched Copilot on, and how to govern it without turning it off.
Frequently asked questions
Is the Essential Eight still worth doing?
Yes. It remains a recognised framework in critical infrastructure rules, government policy and many commercial contracts, and ASD has confirmed existing investment stays relevant. Keep going, just don’t treat it as your AI answer.
When exactly does the Essential Eight disappear?
ASD has described the transition to the ASD Essentials as an evolution rather than a cancellation, with the current guidance becoming the first chapter of the new series. An ASD official has indicated both will run alongside each other for around twelve months, with deprecation beginning then and full retirement expected within about two years of the June 2026 announcement.
What are the ASD Essentials, and what do they replace?
The ASD Essentials are a new series of security guidance grounded in the Information Security Manual. It launched in October 2026 with chapters for enterprise IT, operational technology and cloud, and covers AI through a supporting publication that applies across all three.
Will we have to start our security program again?
No. The transition to the ASD Essentials shifts the focus from prescriptive controls to outcomes and intent, so well-run controls and the evidence behind them remain relevant. A maturity-level score on its own doesn’t tell the full story.
Does the ISM apply to us if we’re a private business?
Not automatically. The ISM is written for government systems and binds a private business only where a contract or framework requires it. That said, it’s increasingly what enterprise and government buyers ask against, and its AI controls are a good preview of what you’ll be asked to evidence.
Does Microsoft 365 Copilot use our data to train AI models?
No. Microsoft states that prompts, responses and data accessed through Microsoft Graph aren’t used to train the foundation models.
Can Copilot see files our staff shouldn’t have access to?
Copilot honours existing permissions, so it surfaces only what that user could already reach. The risk is that many organisations have permissions far more generous than anyone realises, and Copilot makes that visible very quickly.
Is our data kept in Australia?
Storage, yes. Australian tenants are covered by Microsoft’s standard data residency commitment, with no add-on required. Where processing happens is a separate question, and the answer is currently moving. It deserves a proper conversation rather than a one-line response, so talk to us if it’s material for your sector. Health, legal and APRA-regulated work are the usual cases.
We’re a 100-person business. Do we really need an AI register?
Yes, and it’s smaller than it sounds. A single list of AI tools and agents in use, what data each touches, and a named owner for each. ASD now asks government systems for almost exactly this, and the new ASD Essentials framework reinforces the importance of demonstrating effective security governance. It’s a useful record to maintain, and it takes an afternoon to start.
How long does this take?
For a mid-market business with a co-operative IT function, a quarter of focused work is realistic. Longer if your SharePoint environment has grown organically over a decade. A good provider will tell you that before you sign, not after.
